MCP blast radius

The Model Context Protocol (MCP) connects agents to tools and data. Each tool endpoint expands blast radius — what an compromised or misconfigured agent can reach. Control Core constrains MCP blast radius at the Bouncer before tool calls execute.

Threat model

Risk	Without controls	With MCP controls
Tool enumeration	Agent discovers all server tools	Allowlist per agent identity
Cross-tenant data	Agent calls wrong MCP server	Resource + environment binding
Privileged tool abuse	`execute_sql`, `delete_*` unrestricted	Rego deny on dangerous tool names
Shadow MCP servers	Unknown servers on network	Shadow discovery fingerprints MCP paths

How to use

Register MCP servers as resources (RESOURCE_TYPE=mcp-server) in Bouncer env (~10 min).
Enable MCP proxy mode on the protecting Bouncer.
Author MCP controls — template MCP Tool Allowlist or custom Rego:

deny if {
  input.resource.protocol == "mcp"
  input.action.tool_name in data.mcp.dangerous_tools
}

Start in shadow — review SHADOW_WOULD_DENY for tool calls before enforce.

How to review / audit

Audit Logs — filter protocol mcp, inspect action.tool_name and outcome
Compliance & Gaps — MCP path fingerprints in shadow discovery
Compare allowed tools vs PIP inventory of registered MCP servers weekly

Review questions for security committee:

Which agents may call which MCP servers?
Are destructive tools denied for all but break-glass identities?
Do shadow logs show unexpected MCP hosts?

Troubleshooting

Troubleshooting: MCP traffic not evaluated?

Confirm traffic routes through Bouncer — not direct agent→server

Verify RESOURCE_TYPE=mcp-server on registration

Check Bouncer logs: grep -i mcp docker logs bouncer

Troubleshooting: All tool calls denied after enforce?

Deactivated baseline pass-through? Ensure Access Control control allows MCP public paths or authenticated agents

Run Control impact simulator with sample MCP input JSON

Next steps: Agent framework connectors · NHI verification · AI governance overview